Barmak Meftah

🔥 Tomorrow night at 6 pm PDT, join us at the OWASP Orange County #meetup where Mike Larkin, CTO and co-founder of Deepfactor will lead the 90-minute hands-on live #workshop "Vulnerability Reachability Analysis Using OSS Tools” and will dive into: ✅ What vulnerability reachability is and why it is important ✅ Two main ways of understanding reachability (static call graphs and runtime analysis) ✅ Two short exercises for the attendees to gain hands-on experience using both types of tools against real applications with real vulnerabilities We look forward to seeing you there. Check the link in the comments for sign-ups! #AppSec #Security #Deepfactor

13

2 Comments

As we get back from the craziness of RSAC, I'm getting ready for the next big event on the horizon. The CISO Village Summit by Team8 is back with 100 CISOs and security leaders joining me this June in California! The magic of the Summit is more than that of a regular conference; our 300-strong community is a place of genuine curiosity, innovation, and collaboration, offering a forum for professional and personal growth alongside the industry's best. Throughout this exclusive five-day event, don't miss the chance to engage in meaningful discussions with industry leaders on: * The changing threat landscape * AI’s impact on cybersecurity’s challenges and solutions * Socio-economics and geopolitical tensions filtering into cybersecurity policy * The complex CISO-CEO relationship * And more. Spots are limited and closing fast— so apply now to not miss out! https://lnkd.in/gKj-jvS5 Team8 #Team8CISOVillage #Cybersecurity

171

9 Comments

It's a fucking honor to build products for the 99% of businesses that fall below the Fortune 500 poverty line 💪 While the Fortune 500 said SIEM was tired, the Fortune 5,000,000 showed us how to mic-drop! 🫳🎤 🧠 Affordable, predictive pricing *is* possible if you only store what matters 💾 Retaining / hunting thru petabytes of daily data *won't* break the model 💵 You can protect more than just your critical servers *if* the price is right Can't tell you how dope it feels to work with MSP partners / Customers to completely disrupt these perceptions—currently ingesting logs from 500,000+ data sources! Massive thanks to those Product Lab believers that demanded a new way to SIEM https://lnkd.in/eXKgmEHP and the team at ClickHouse who helped us reimagine a different approach to storage and scalability 🙏 https://lnkd.in/eVSh2Yfx

393

23 Comments

At the last Internet Identity Workshop, I announced my talk: “5yrs ago at this conference, Trinsic launched our self-sovereign identity platform. Today, I’m hosting a session called “SSI didn’t work. Trinsic is pivoting.” Since then it’s been a whirlwind helping customers improve their IDV flows through Identity Acceptance—accepting a digital ID (like mobile driver's license) instead of uploaded photos of physical IDs. Only recently, during a couple of 2am - 5am shifts with a newborn baby, did I get around to following up on that IIW talk. 😂 Many people asked me to turn that presentation into a blog post, so here it is! The intent of the post is simple. I’m no longer betting on interoperable digital credentials taking off. This post articulates why. Specifically, interoperable, standards-based digital credentials like verifiable credentials (and its variants) face three impossible* problems that block adoption: Interoperability vs innovation catch-22 UX always worse initially Scattered heat map I dive into each of these problems in depth in this post. If someone can crack these, they’ll quickly be a millionaire. Obviously, there are hundreds of organizations that ostensibly want interoperable digital credentials. But despite all this spend and attention, have failed to adopt. If these problems are solved, I think adoption can occur and the enablers can succeed wildly. *While I term these "impossible problems", I hope I'm proven wrong. This post is my call for others to pick up the baton and run with it, not from the starting line, but with hard-earned lessons behind them. There are probably only 100 people on earth that care enough about this topic to read the whole post & apply the content. But if you’re one of those, I’d love to hear your feedback & keep the discussion going! Big thanks to Kim Hamilton Duffy Timothy Ruff Gerald Glickman Eve Maler David Grantham James Monaghan and Zachary Jones for giving feedback on a draft of this post 🙏 https://lnkd.in/g7KkY656

220

75 Comments

Last week, Gartner’s Hype Cycle for Application Security dropped, and we were pleased to see Software Supply Chain Security moving deeply into the trough of disillusionment. A real thing is currently happening with SCAs: customers are starting to realize they’re not enough. As we talk to our champions, a clear image emerges—the sentiment is changing from “how can we detect stuff” and “what is a supply chain attack” into “Is this even vulnerable?” and “how can we fix it?“. The pain is real, Myrror Security can help you!

23

1 Comment

In our latest podcast episode featuring Jeremy Snyder, Founder & CEO of FireTail.io, we explored the evolving cybersecurity landscape and the crucial role of API security in protecting modern enterprises and IoT devices. 🔐   FireTail is leading the charge in end-to-end API security, ensuring that organizations can safeguard their systems from code to cloud. In our conversation, we discussed the implications of AI in cybercrime, the differences between cloud, on-premise, and edge device security, and the importance of API design in preventing breaches.   🎙 Key Takeaways: - The rise of AI and automation in cybercrime and its growing impact - Why securing APIs is essential for modern software and IoT ecosystems - Cloud vs. on-prem vs. edge: How to approach cybersecurity differently - The importance of proper authorization controls in preventing API abuse Listen now at: IoT ONE Podcast Page: https://lnkd.in/ePx6drjD Apple Podcasts: https://lnkd.in/fF27x-6 Spotify Podcasts: https://lnkd.in/gDN22fV

3

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

This year has been transformative for the ContraForce team. I'm proud to announce our Seed round of $3.25M, bringing our total funding to over $5.5M. I want to thank our fantastic investment partners at DataTribe, GALLOS Technologies. and Y Combinator for the support to bring the first Security Service Delivery Platform (SSDP) to market! While funding is part of the process to help us scale our platform and support our customers, I wanted to share just some of the achievements from 2024: ⚡ Launched our platform and operations in EMEA and APAC ⚡ Our ARR has grown over 350% (and the year isn't done yet!) ⚡ Recognized by Microsoft as their Security Vendor of the year ⚡ Recognized by SC Media as the most promising early-stage startup ⚡ Recognized by SINET as a winner of the SINET16 Innovator award ⚡ Recognized by Cyberdefense Magazine as a top InfoSec Innovator winner for Security Service Delivery Platform Yet there is so much more to list! With an incredible team and a new market to help transform security service delivery into a digital utility, we're headed to the skies! 🚀 Thank you to all of our team members, investors, advisors, customers, and partners for making this possible. We're just at the beginning of this incredible journey. #startup #securityservices #securityoperations

74

22 Comments

The Future of Compliance is Now-

67

2 Comments

CyberSec Alert: A new attack technique bypasses #Microsoft's Driver Signature Enforcement on fully patched Windows systems, enabling attackers to load unsigned kernel drivers and compromising the integrity of OS security. Learn more: Discover how a new attack technique bypasses Microsoft’s security, enabling OS downgrade attacks on Windows.https://https://lnkd.in/gQC63WQs #cybersecurity #infosec #datasecurity #cybercrime #securityawareness #networksecurity #cyberattack #databreach #ITsecurity #cyberthreats

5

Great thinking on best ways to identify, prioritize and focus on what's important and what's not in proactive security.

4

Great benchmarks and quite the sweet spot for most M&A in Cybersecurity. The recent Noname and Zerofox deals also reflect this "mean reversion" type of behavior~

11

So, A LOT has happened at RSAC this week. But one dramatic event really stood out to me: Over 50(!) CEOs, CTOs, and CISOs signed CISA’s Secure by Design pledge, bringing the total number of signers to about 68. 🎉 Yes, it is just a pledge. Yes, it is nothing but a promise. Yes, it might seem pretty basic. Yes, some of those who signed are security vendors that mostly wanted some extra attention. But, it is also a step in the right direction. We should view it as more than just a checklist —but as a collective promise to prioritize security over shortcuts and inspire a new era where secure by design is the norm, not the exception. Let's applaud the courage of these leaders and continue pushing for Secure by Design principles to become the norm. Thank you Jen Easterly and CISA for pushing this important initiative. Hopefully, by next RSAC, 50 will become 500. #Cybersecurity #SecureByDesign #RSAC #CISA

74

2 Comments

Our own Nathan Svec joined Joe Alapat, Liongard's Chief Product Officer, on stage at Roarcon 2024 to discuss how Rewst leverages Liongard's integration for critical cyber risk remediation. 🦁   One of those use cases, MFA remediation, is now available as a pre-built automation in our Crate Marketplace.  Here's the scoop: when Liongard creates an actionable alert ticket in your PSA titled "Exposure to User Account(s) Due to Lack of Strong Authentication," our Crate takes over. The automation checks Microsoft Azure for users without MFA and automatically adds them to a Conditional Access policy—easy, secure, and automated.     Key Features:    🔧 Customizable Setup - Supports new or existing Conditional Access policies and groups.  🔒 Automated Remediation: Ensures automatic enforcement of MFA on all user accounts.    Learn more about our Liongard integration and the automation use cases it unlocks: https://lnkd.in/gFCsKvFa     #Liongard #RoarCon24 

51

4 Comments

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

☁ As organizations shift to cloud-native environments, robust secrets management becomes critical. In a recent episode of "Taking Stock," Trinity Chavez, Lead Anchor of NYSE TV, interviews Oded Hareven, co-founder and CEO of Akeyless Security. Oded discusses how machines, now more numerous than employees, hold secrets that need protection. He explains how Akeyless Distributed Fragments Cryptography (DFC) secures these secrets without ever combining encryption key fragments. Akeyless offers an all-in-one, unified secrets and machine identity platform that addresses current and future needs, providing immediate value with low infrastructure footprint. Discover how Akeyless is a game-changer in machine identity management. 👉 https://www.akeyless.io/ #Cybersecurity #CloudSecurity #SecretsManagement #MachineIdentity #Akeyless

32

1 Comment

Dear CISOs/Security experts, This is a rare opportunity to adopt change and take action against cloud attacks. We are helping security teams shift from visibility and prioritization to actually taking down cloud security risks I'm inviting you to meet me at BH (https://lnkd.in/eQssze2q) Happy to show you how the future of cloud security looks like #blackhat2024 #cloudrisk #riskremediation

39

2 Comments

You need to use the findings and automate based on those. eBPF is not enough.

2

Just in time for October Cybersecurity Month - check out SeeMetrics newly updated boards for all people in the security org! From GRC to vuln management to product to CISO, each one can see real-time relevant metrics for what's needed. This month's webinar w/ CEO Shirley Salzman below:

2